build(deps): bump @adastracomputing/ink from 0.8.0 to 0.15.0 in /examples/foreign-sender-receiver

[dependabot]

Bumps @adastracomputing/ink from 0.8.0 to 0.15.0.

Release notes

Sourced from @​adastracomputing/ink's releases.

v0.15.0

Changes

• The Agent Card signature reaches Phase B: producer signing is now normative. The reference receiver signs every card it serves, and a deployed producer signs every card it can root under the trust rules of https://github.com/Ad-Astra-Computing/ink/blob/HEAD/specs/ink-agent-card-signature.md §4. A key-derived producer signs against its genesis key (directly for a never-rotated identity, or through a rotationChain it can root back to the genesis key); a did:web producer signs and anchors the signing key in its DID document. A producer never emits a cardSignature it cannot root, so an unrootable identity stays unsigned rather than serving a proof a verifier would reject.
• keySetVersion and updatedAt are now emitted on every signed card, as §6 requires on publish.
• No change to the 1.0 base profile. The cardSignature and rotationChain members and the agent-card-signature conformance category are unchanged from 0.14.0; Phase B is a producer-side obligation, so a receiver validates a card exactly as before. Phase B starts the mandatory minimum 90-day window before Phase C (§10), under which the 1.0 profile rejects an unsigned key-derived card.
• The multi-hop authorization (delegation) chain ships as a named post-1.0 extension: a normative spec at https://github.com/Ad-Astra-Computing/ink/blob/HEAD/specs/ink-authorization-chain.md (superseding the archived 2026-05 draft), a reference verifier, Go parity and a 51-case authorization-chain conformance category under a new delegation capability. Chains are root-first arrays of delegation links built on the grant field model with strict attenuation and a hard depth cap of 4. The category is additive and optional; the 1.0 base profile and its frozen categories are untouched.
• The compatibility policy now states the strict frozen wire accurately: unknown fields are tolerated or rejected per surface, the protocol value is a closed per-surface enum, intent types and receipt dispositions are closed enums and a second cryptographic suite arrives through a reserved top-level card member with receiver-first negotiation. Adopter-facing examples and the wire-version notes were corrected to match, and the section 6 registry now notes that an intent envelope carries no type member.
• Dev dependency and example dependency updates clear all open npm advisories; the audit gate is clean across every project in the repo.

Promotion

Promoted to the latest dist-tag on 2026-08-03 via the publish workflow (run 30792499183). Pre-promotion checks recorded at dispatch: the production compatibility gate read clean on 0.15.0 with zero stored-row rejects on a fresh measurement and the live sign-in smoke passed all seven checks against the deployment running 0.15.0.

v0.14.0

Additions

• Self-authenticating Agent Card. A card MAY carry a cardSignature proof and a rotationChain so a consumer can establish key authority from the card itself rather than resting on TLS and registry honesty alone. A conforming receiver

... (truncated)

Changelog

Sourced from @​adastracomputing/ink's changelog.

0.15.0, Agent Card producer signing (Phase B)

Changes

• The Agent Card signature reaches Phase B: producer signing is now normative. The reference receiver signs every card it serves, and a deployed producer signs every card it can root under the trust rules of https://github.com/Ad-Astra-Computing/ink/blob/main/specs/ink-agent-card-signature.md §4. A key-derived producer signs against its genesis key (directly for a never-rotated identity, or through a rotationChain it can root back to the genesis key); a did:web producer signs and anchors the signing key in its DID document. A producer never emits a cardSignature it cannot root, so an unrootable identity stays unsigned rather than serving a proof a verifier would reject.
• keySetVersion and updatedAt are now emitted on every signed card, as §6 requires on publish.
• No change to the 1.0 base profile. The cardSignature and rotationChain members and the agent-card-signature conformance category are unchanged from 0.14.0; Phase B is a producer-side obligation, so a receiver validates a card exactly as before. Phase B starts the mandatory minimum 90-day window before Phase C (§10), under which the 1.0 profile rejects an unsigned key-derived card.
• The multi-hop authorization (delegation) chain ships as a named post-1.0 extension: a normative spec at https://github.com/Ad-Astra-Computing/ink/blob/main/specs/ink-authorization-chain.md (superseding the archived 2026-05 draft), a reference verifier, Go parity and a 51-case authorization-chain conformance category under a new delegation capability. Chains are root-first arrays of delegation links built on the grant field model with strict attenuation and a hard depth cap of 4. The category is additive and optional; the 1.0 base profile and its frozen categories are untouched.
• The compatibility policy now states the strict frozen wire accurately: unknown fields are tolerated or rejected per surface, the protocol value is a closed per-surface enum, intent types and receipt dispositions are closed enums and a second cryptographic suite arrives through a reserved top-level card member with receiver-first negotiation. Adopter-facing examples and the wire-version notes were corrected to match, and the section 6 registry now notes that an intent envelope carries no type member.
• Dev dependency and example dependency updates clear all open npm advisories; the audit gate is clean across every project in the repo.

0.14.0, self-authenticating Agent Card trust root and Go sender parity

Additions

• Self-authenticating Agent Card. A card MAY carry a cardSignature proof and a rotationChain so a consumer can establish key authority from the card itself rather than resting on TLS and registry honesty alone. A conforming receiver verifies the proof if present, rejects a card whose present proof is invalid, ratchets forward on a valid proof and roots the rotation chain by principal kind. The members are OPTIONAL and backward compatible: an unsigned card from an existing deployment still validates, and a consumer unaware of the new

... (truncated)

Commits

• e519d20 Release 0.15.0 (#234)
• c7cd009 Activate Agent Card producer signing (Phase B) (#233)
• df39f17 Add the authorization chain delegation extension (#232)
• 2f93eaf build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#222)
• 304bedf build(deps): bump nixpkgs from 753cc8a to e2587ca (#228)
• a114eb6 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#221)
• 24e25bc Bump dev dependencies and clear the brace-expansion advisory (#231)
• 2ff2d16 Correct adopter-facing examples and wire-version docs (#220)
• bed7e02 Align compatibility policy with the strict frozen wire (#219)
• d7406a9 Sync README and reference receiver to 0.14.0 (#218)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)